Public IP on MacBook keeps changing randomly though there is no VPN

Question

I have a MacBook Pro and it recently went in for repair for battery replacement. Ever since I got it back, I have been noticing that some streaming platforms are not working or showing content from different locations.

To investigate this, I have tried to check my public IP Address and found out that it is showing an IP address from a different country. I have been testing it out on https://ipleak.net/ and https://www.whatismyip.com/my-ip-information/ and I'm getting different public IP on both.

I have tried this on my other devices that are connected to the same network and all of those devices are showing consistent information. I have also tested my laptop on various networks, and it the public IP is always from a random country only on my laptop.

Essentially, my laptop is behaving as if it is on VPN even though there is no VPN setup at all.

I have attached screenshots from different websites for the same. I am not in Hong Kong but it is currently showing Hong Kong as my location and websites like Hotstar are showing me Hong Kong related content. It sometimes shows Singapore / USA as well. I am actually in India.

Please help me understand this issue. I have tried resetting the network settings on my Mac but there is no use.

Some Additional Details:

raghava@MacBook-Pro ~ % scutil
> show State:/Network/Global/IPv4
<dictionary> {
  PrimaryInterface : en0
  PrimaryService : B9DF3F22-52B6-4B9A-B3BA-3D229089DEFA
  Router : 10.0.0.1
}
> show State:/Network/Interface/en0/IPv4
<dictionary> {
  Addresses : <array> {
    0 : 10.0.0.60
  }
  BroadcastAddresses : <array> {
    0 : 10.0.1.255
  }
  SubnetMasks : <array> {
    0 : 255.255.254.0
  }
}
> exit
raghava@MacBook-Pro ~ % curl ip.me
8.17.206.231

raghava@MacBook-Pro ~ % ifconfig -a
lo0: flags=8049<UP,LOOPBACK,RUNNING,MULTICAST> mtu 16384
    options=1203<RXCSUM,TXCSUM,TXSTATUS,SW_TIMESTAMP>
    inet 127.0.0.1 netmask 0xff000000 
    inet6 ::1 prefixlen 128 
    inet6 fe80::1%lo0 prefixlen 64 scopeid 0x1 
    inet 127.94.0.1 netmask 0xff000000 
    inet 192.0.2.2 netmask 0xffffff00 
    nd6 options=201<PERFORMNUD,DAD>
gif0: flags=8010<POINTOPOINT,MULTICAST> mtu 1280
stf0: flags=0<> mtu 1280
ap1: flags=8802<BROADCAST,SIMPLEX,MULTICAST> mtu 1500
    options=400<CHANNEL_IO>
    ether 3a:f9:d3:98:7d:95 
    media: autoselect
    status: inactive
en5: flags=8863<UP,BROADCAST,SMART,RUNNING,SIMPLEX,MULTICAST> mtu 1500
    ether ac:de:48:00:11:22 
    inet6 fe80::aede:48ff:fe00:1122%en5 prefixlen 64 scopeid 0x5 
    nd6 options=201<PERFORMNUD,DAD>
    media: autoselect (100baseTX <full-duplex>)
    status: active
en1: flags=8963<UP,BROADCAST,SMART,RUNNING,PROMISC,SIMPLEX,MULTICAST> mtu 1500
    options=460<TSO4,TSO6,CHANNEL_IO>
    ether 82:4c:5b:e8:54:01 
    media: autoselect <full-duplex>
    status: inactive
en2: flags=8963<UP,BROADCAST,SMART,RUNNING,PROMISC,SIMPLEX,MULTICAST> mtu 1500
    options=460<TSO4,TSO6,CHANNEL_IO>
    ether 82:4c:5b:e8:54:00 
    media: autoselect <full-duplex>
    status: inactive
en3: flags=8963<UP,BROADCAST,SMART,RUNNING,PROMISC,SIMPLEX,MULTICAST> mtu 1500
    options=460<TSO4,TSO6,CHANNEL_IO>
    ether 82:4c:5b:e8:54:05 
    media: autoselect <full-duplex>
    status: inactive
en0: flags=8863<UP,BROADCAST,SMART,RUNNING,SIMPLEX,MULTICAST> mtu 1500
    options=6463<RXCSUM,TXCSUM,TSO4,TSO6,CHANNEL_IO,PARTIAL_CSUM,ZEROINVERT_CSUM>
    ether 38:f9:d3:98:7d:95 
    inet 10.0.0.60 netmask 0xfffffe00 broadcast 10.0.1.255
    inet6 fe80::18b2:3e8b:e936:73ff%en0 prefixlen 64 secured scopeid 0x9 
    nd6 options=201<PERFORMNUD,DAD>
    media: autoselect
    status: active
en4: flags=8963<UP,BROADCAST,SMART,RUNNING,PROMISC,SIMPLEX,MULTICAST> mtu 1500
    options=460<TSO4,TSO6,CHANNEL_IO>
    ether 82:4c:5b:e8:54:04 
    media: autoselect <full-duplex>
    status: inactive
awdl0: flags=8943<UP,BROADCAST,RUNNING,PROMISC,SIMPLEX,MULTICAST> mtu 1500
    options=400<CHANNEL_IO>
    ether 76:83:f6:f7:00:c7 
    inet6 fe80::7483:f6ff:fef7:c7%awdl0 prefixlen 64 scopeid 0xb 
    nd6 options=201<PERFORMNUD,DAD>
    media: autoselect
    status: active
bridge0: flags=8863<UP,BROADCAST,SMART,RUNNING,SIMPLEX,MULTICAST> mtu 1500
    options=63<RXCSUM,TXCSUM,TSO4,TSO6>
    ether 82:4c:5b:e8:54:01 
    Configuration:
        id 0:0:0:0:0:0 priority 0 hellotime 0 fwddelay 0
        maxage 0 holdcnt 0 proto stp maxaddr 100 timeout 1200
        root id 0:0:0:0:0:0 priority 0 ifcost 0 port 0
        ipfilter disabled flags 0x0
    member: en1 flags=3<LEARNING,DISCOVER>
            ifmaxaddr 0 port 6 priority 0 path cost 0
    member: en2 flags=3<LEARNING,DISCOVER>
            ifmaxaddr 0 port 7 priority 0 path cost 0
    member: en3 flags=3<LEARNING,DISCOVER>
            ifmaxaddr 0 port 8 priority 0 path cost 0
    member: en4 flags=3<LEARNING,DISCOVER>
            ifmaxaddr 0 port 10 priority 0 path cost 0
    nd6 options=201<PERFORMNUD,DAD>
    media: <unknown type>
    status: inactive
llw0: flags=8863<UP,BROADCAST,SMART,RUNNING,SIMPLEX,MULTICAST> mtu 1500
    options=400<CHANNEL_IO>
    ether 76:83:f6:f7:00:c7 
    inet6 fe80::7483:f6ff:fef7:c7%llw0 prefixlen 64 scopeid 0xd 
    nd6 options=201<PERFORMNUD,DAD>
    media: autoselect
    status: active
utun1: flags=8051<UP,POINTOPOINT,RUNNING,MULTICAST> mtu 1380
    inet6 fe80::d16a:f386:528c:2238%utun1 prefixlen 64 scopeid 0xf 
    nd6 options=201<PERFORMNUD,DAD>
utun2: flags=8051<UP,POINTOPOINT,RUNNING,MULTICAST> mtu 2000
    inet6 fe80::5ddc:1cc6:c5da:7b45%utun2 prefixlen 64 scopeid 0x10 
    nd6 options=201<PERFORMNUD,DAD>
utun3: flags=8051<UP,POINTOPOINT,RUNNING,MULTICAST> mtu 1000
    inet6 fe80::ce81:b1c:bd2c:69e%utun3 prefixlen 64 scopeid 0x11 
    nd6 options=201<PERFORMNUD,DAD>
utun0: flags=8051<UP,POINTOPOINT,RUNNING,MULTICAST> mtu 1280
    inet 172.16.0.2 --> 172.16.0.2 netmask 0xffffffff 
    inet6 fe80::aede:48ff:fe00:1122%utun0 prefixlen 64 scopeid 0x12 
    inet6 fd01:5ca1:ab1e:82d7:cc89:cdfc:467d:b81e prefixlen 128 
    nd6 options=201<PERFORMNUD,DAD>

I ran traceroute at https://www.whatsmyip.org/traceroute/ and below is the result

score 1 · Accepted Answer · answered Dec 06 '21 at 05:41

1

Turns out there is Cloudflare Warp https://1.1.1.1/ set up on a different user account but was made applicable on all the user accounts.

I wasn't able to see that until I logged in to the other account suspecting something like this.

answered Dec 06 '21 at 05:41

raghava

11

Good find. Presumably the utun interaces were tunneling traffic to cloudflare? – bmike Dec 06 '21 at 05:47

bmike · Answer 2 · 2021-12-04T20:14:01.643

0

This is almost always not an IP address assigned to any computer since typically, your device will connect to a router that runs NAT. Nothing about your setup seems to involve VPN - just run of the mill networking behind NAT gateways.

You can confirm this from the command line with scutil

bmike@m1 /Users % scutil
> show State:/Network/Global/IPv4
<dictionary> {
  PrimaryInterface : en0
  PrimaryService : 73EEA9EF-DA84-4A1E-9E0A-0B24FF6C0091
  Router : 192.168.0.1
}
> show State:/Network/Interface/en0/IPv4
<dictionary> {
  Addresses : <array> {
    0 : 192.168.0.103
  }
  BroadcastAddresses : <array> {
    0 : 192.168.0.255
  }
  SubnetMasks : <array> {
    0 : 255.255.255.0
  }
}
> exit
bmike@m1 /Users % curl ip.me
160.130.4.141

The Mac can only control when it requests / changes an address to any interface. It's up to the network router to get a public IPv4 address and/or IPv6 address.

In my case, my router is the device that is using 160.130.4.141 (if I were actually using the space previously assigned to SONY corporation and now is assigned to the Florida Department of Management Services). You should check your router or ISP to determine why it (they) are cycling your address.

edited Dec 04 '21 at 20:14

answered Dec 04 '21 at 20:08

bmike

235,889

`raghava@MacBook-Pro ~ % scutil

show State:/Network/Global/IPv4

{ PrimaryInterface : en0 PrimaryService : B9DF3F22-52B6-4B9A-B3BA-3D229089DEFA Router : 10.0.0.1 }

show State:/Network/Interface/en0/IPv4

{ Addresses : { 0 : 10.0.0.60 } BroadcastAddresses : { 0 : 10.0.1.255 } SubnetMasks : { 0 : 255.255.254.0 } }

exit

raghava@MacBook-Pro ~ % curl ip.me 8.17.206.231`
– raghava Dec 05 '21 at 01:24
This Link is a similar problem. But I don't have CISCO web security addon. I'm trying to figure out if there is anything similar on my system. Is there a command that I could run and get some insights on this? – raghava Dec 05 '21 at 01:31
1

@raghava Yes! You want to log in to the router at 10.0.0.1 and figure why it’s changing IP address. You should see even when the external IP address changes, your mac doesn’t draw a new IPv4 address 10.0.060 - that’s the address macOS is working with - not directly hosting the public address due to NAT. – bmike Dec 05 '21 at 03:31
1

Isn't 172.16.x.x indicative of CG-NAT? private address space showing as public? – Tetsujin Dec 05 '21 at 08:32

Public IP on MacBook keeps changing randomly though there is no VPN

2 Answers2